Extract shared private cleanup-file writer by Copilot · Pull Request #10064 · github/gh-aw-firewall

Copilot · 2026-10-16T03:28:56Z

The NVX and Cloud Hypervisor cleanup stores duplicated private-file creation, writing, syncing, and closing logic. This duplication risked behavioral drift between cleanup persistence paths.

Shared utility
- Added src/private-file.ts with the common exclusive mode-0600 write-through implementation.
Cleanup stores
- Updated NVX and Cloud Hypervisor stores to pass their open dependency to the shared helper.
- Removed duplicated local helpers while preserving existing atomicity and cleanup behavior.

await writePrivateFile(
  dependencies.open,
  temporaryPath,
  contents,
);

Fixes [Duplicate Code] Shared cleanup-file writer helper #10038

Copilot

🟢 Approval recommended

The focused extraction preserves existing behavior and introduces no blocking issues.

0 open findings

What changed in this PR

Extracts duplicated private-file writing into a shared utility for the NVX and Cloud Hypervisor cleanup stores.

Changes:

Centralizes exclusive mode-0600 creation, writing, syncing, and closing.
Updates both stores to use the helper while preserving existing persistence behavior.

File	Description
src/private-file.ts	Adds the shared private-file writer.
src/nvx/cleanup-store.ts	Replaces the local writer with the shared helper.
src/cloud-hypervisor/cleanup-record-store.ts	Uses the shared helper for records and claims.

🧠 Review effort: Max

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-10-16T04:28:42Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-10-16T04:34:49Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	93.19%	93.19%	➡️ +0.00%
Statements	91.77%	91.77%	➡️ +0.00%
Functions	90.68%	90.67%	📉 -0.01%
Branches	85.63%	85.64%	📈 +0.01%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/nvx/cleanup-store.ts`	70.6% → 69.1% (-1.45%)	65.6% → 64.0% (-1.55%)
`src/cloud-hypervisor/cleanup-record-store.ts`	97.9% → 97.8% (-0.07%)	94.6% → 94.4% (-0.17%)
`src/log-directory-setup.ts`	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)

✨ New Files (1 files)

src/private-file.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-10-16T04:36:40Z

🔑 Smoke Copilot BYOK AOAI (api-key) is testing Azure OpenAI BYOK (api-key) mode on this pull request...

github-actions · 2026-10-16T04:36:41Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-10-16T04:36:44Z

✅ Smoke Claude passed

Generated by Smoke Claude for #10064

github-actions · 2026-10-16T04:36:44Z

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

github-actions · 2026-10-16T04:36:45Z

🪪 Smoke Copilot BYOK AOAI (Entra) is testing Azure OpenAI BYOK (Entra / GitHub OIDC) mode on this pull request...

github-actions · 2026-10-16T04:36:45Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #10064

github-actions · 2026-10-16T04:36:46Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-10-16T04:36:46Z

💎 Smoke Gemini is crystallizing results on this pull request...

github-actions · 2026-10-16T04:36:48Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-10-16T04:36:49Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-10-16T04:36:52Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-10-16T04:36:55Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-10-16T04:37:00Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-10-16T04:37:02Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-10-16T04:46:00Z

Cloud Hypervisor + Copilot smoke test

Merged PR lookup: PASS
github.com connectivity: PASS (HTTP 200)
File write/read: PASS
example.com blocked: PASS (HTTP 000)
Overall: PASS

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:46:34Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
GH CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #10064 · claude · haiku45 · 23.9 AIC · ⊞ 6.1K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:46:57Z

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

✅ MCP connectivity: Verified
✅ GitHub.com HTTP: 200 OK
✅ File I/O: Readable
✅ BYOK inference: Direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com working

All smoke tests passed. Running in direct BYOK mode as expected.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:47:15Z

Smoke Copilot — PR: "Extract shared private cleanup-file writer"

✅ GitHub MCP (latest merged: chore(deps): bump the all-github-actions group with 3 updates #10067)
✅ github.com connectivity (HTTP 200)
✅ File write/read
Overall: PASS — @Copilot @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:47:21Z

EGRESS_RESULT allow=pass deny=pass
✅ Allowed (api.github.com): HTTP 403 received (reachable)
✅ Blocked (example.com): blocked
Overall: PASS — cc @lpcox

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:47:25Z

OTEL smoke test

✅ S1: otel.js loads; exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled
✅ S2: OTEL tests pass, 3 suites, 68 tests
✅ S3: env forwarding present (env-passthrough.ts trace/parent IDs; api-proxy-env-config.ts OTEL vars)
✅ S4: onUsage hook exists in token-tracker-http.js
✅ S5: otel.jsonl present with 1 record (no api-proxy spans expected in this run)

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:47:45Z

Smoke services: ✅ Redis PONG · ✅ pg_isready accepting connections · ✅ SELECT 1 = 1. PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:48:02Z

feat: correlate enclave handoff and VMM launch diagnostics — ❌
Extract shared private cleanup-file writer — ✅
PR detail lookup — ✅
Playwright title check — ❌
Temp file write/read — ✅
Build (npm ci && npm run build) — ✅
Discussion comment — ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:48:26Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	not run	❌ FAIL
Bun	hono	❌	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	not run	❌ FAIL
Deno	std	❌	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 6/8 ecosystems passed — FAIL

Failures

Bun and Deno: the curl | bash / curl | sh installer commands were denied by the sandbox permission policy, so neither tool was installed and no tests ran. The sandbox did not bypass this.
Workarounds used for the passing ecosystems: .NET needed XDG_RUNTIME_DIR and DOTNET_CLI_HOME set to writable paths, and Maven needed a writable -Dmaven.repo.local. Both failed on their first runs because of the runner's home and runtime directories.

The build-test label was not added because not all ecosystems passed.

Generated by Build Test Suite for #10064 · copilot · auto · 18 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-10-16T04:48:37Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.15	Python 3.12.15	✅ YES
Node.js	v24.21.0	v2.98.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Not all tests passed (Node.js mismatch), so the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

Initial plan

3e6ca8e

Copilot AI assigned Copilot and lpcox Oct 16, 2026

Copilot AI linked an issue Oct 16, 2026 that may be closed by this pull request

[Duplicate Code] Shared cleanup-file writer helper #10038

Closed

Copilot started work on behalf of lpcox October 16, 2026 03:29

View session

refactor: share private cleanup file writer

5041f08

Copilot AI changed the title ~~[WIP] Refactor shared cleanup-file writer helper to reduce duplication~~ Extract shared private cleanup-file writer Oct 16, 2026

Copilot finished work on behalf of lpcox October 16, 2026 03:33

Copilot AI requested a review from lpcox October 16, 2026 03:33

lpcox marked this pull request as ready for review October 16, 2026 03:34

Copilot AI max review requested due to automatic review settings October 16, 2026 03:34

Copilot started reviewing on behalf of lpcox October 16, 2026 03:34

View session

Copilot AI reviewed Oct 16, 2026

View reviewed changes

lpcox added the ready-for-aw label Oct 16, 2026

lpcox enabled auto-merge (squash) October 16, 2026 04:36

lpcox had a problem deploying to aoai-model October 16, 2026 04:36 — with GitHub Actions Failure

github-actions Bot added the smoke-cloud-hypervisor label Oct 16, 2026

github-actions Bot added the smoke-claude label Oct 16, 2026

github-actions Bot mentioned this pull request Oct 16, 2026

[aw] Smoke Gemini finished without a clear failure cause #10068

Closed

github-actions Bot added the smoke-copilot-byok label Oct 16, 2026

lpcox deployed to aoai-model October 16, 2026 04:47 — with GitHub Actions Active

github-actions Bot added smoke-copilot smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Oct 16, 2026

lpcox had a problem deploying to aoai-model October 16, 2026 04:47 — with GitHub Actions Failure

github-actions Bot added the smoke-services label Oct 16, 2026

lpcox merged commit ae65ae2 into main Oct 16, 2026
147 of 158 checks passed

lpcox deleted the copilot/duplicate-code-shared-cleanup-file-helper branch October 16, 2026 04:56

Conversation

Copilot AI commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Oct 16, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Oct 16, 2026

Chroot Version Comparison

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Copilot AI commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading

github-actions Bot commented Oct 16, 2026 •

edited

Loading